Skill UI

A comprehensive guide and script collection for auditing Google Cloud Platform IAM permissions. It helps identify overly permissive bindings, unused service accounts, primitive role usage, and cross-project access risks. It utilizes gcloud CLI, Policy Analyzer, and IAM Recommender to ensure compliance and minimize the blast radius of misconfigurations.

Systematically review Kubernetes RBAC roles, bindings, and service accounts to surface overly permissive access, privilege escalation paths, and least-privilege violations using tools like rbac-tool and KubiScan.

This technique abuses the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) to impersonate a Domain Controller (DC). By exploiting replication rights (e.g., DS-Replication-Get-Changes-All), attackers can dump password hashes for critical accounts, such as KRBTGT and Domain Admins. The extracted hashes are used to forge Golden Tickets, achieving long-term, persistent domain access. This is a critical post-exploitation method used during authorized red team engagements.

This guide details comprehensive detection methods for DCSync attacks (MITRE T1003.006) in Active Directory. Attackers abuse legitimate directory replication protocols to extract sensitive password hashes. Detection relies on auditing Windows Event ID 4662 for unauthorized access attempts to critical Directory Service GUIDs, specifically flagging non-domain-controller accounts attempting replication calls. Essential for threat hunting and incident response.

A comprehensive guide for detecting Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769). This technique targets service accounts with Service Principal Names (SPNs), which are requested offline by attackers to crack service account passwords. Use this during threat hunting or incident response to scope MITRE T1558 credential access activities in Active Directory environments.

This skill provides a framework for proactively detecting service account abuse, which often occurs through anomalous interactive logons, privilege escalation, or lateral movement. It leverages EDR/SIEM telemetry (e.g., CrowdStrike, Splunk) and advanced threat intelligence rules (Sigma) to identify compromised accounts performing unexpected activities. Ideal for incident response, threat hunting, and security posture assessment.

Kerberoasting is a credential access attack (T1558.003) targeting Active Directory service accounts with Service Principal Names (SPNs). This skill demonstrates using Impacket to request Kerberos TGS tickets for these accounts. The resulting RC4 or AES-encrypted tickets are then cracked offline using tools like Hashcat or John the Ripper, allowing attackers to recover service account credentials for lateral movement during authorized penetration testing or red-team engagements.

This guide details how to implement AWS Config managed and custom rules to establish continuous compliance monitoring for AWS resources. It helps detect configuration drift against standards like CIS and PCI DSS, enabling automated remediation using services like SSM Automation. It is ideal for building centralized compliance dashboards and aggregating audit evidence across multiple AWS accounts via AWS Organizations.

This comprehensive guide details the end-to-end deployment of Delinea Secret Server for robust Privileged Access Management (PAM). It provides scripts and steps for configuring the vault infrastructure, defining secret templates, and automating the discovery of privileged credentials across hybrid environments. Essential for organizations needing centralized, compliant, and automatically rotated management of shared and service accounts.

This guide teaches how to implement and audit Google Cloud Platform (GCP) VPC firewall rules using gcloud. It covers creating restrictive ingress and egress rules, enforcing network segmentation using tags and service accounts, and auditing for overly permissive settings. Ideal for compliance, zero-trust architectures, and responding to security findings.

This guide outlines best practices for hardening Kubernetes Role-Based Access Control (RBAC). It focuses on implementing least-privilege principles by auditing and removing excessive cluster-admin bindings, scoping roles to namespaces, separating service accounts, and integrating external OIDC providers. Use this when improving cluster security posture, meeting compliance standards, or mitigating privilege escalation risks.

Kerberoasting is a post-exploitation technique used in Active Directory environments. It targets service accounts by requesting encrypted Kerberos TGS tickets for accounts with Service Principal Names (SPNs). These tickets are then cracked offline using tools like hashcat to recover the service account's NTLM credentials. This skill is intended only for authorized red team engagements and penetration testing to assess AD privilege escalation risks.